[DOCS] Add EQL limitations page (#52001)
Documents limitations for EQL in Elasticsearch.
This commit is contained in:
parent
20453d3ac8
commit
ca34817659
|
@ -32,7 +32,9 @@ Consider using EQL if you:
|
||||||
* <<eql-requirements>>
|
* <<eql-requirements>>
|
||||||
* <<eql-search>>
|
* <<eql-search>>
|
||||||
* <<eql-syntax>>
|
* <<eql-syntax>>
|
||||||
|
* <<eql-limitations>>
|
||||||
|
|
||||||
include::requirements.asciidoc[]
|
include::requirements.asciidoc[]
|
||||||
include::search.asciidoc[]
|
include::search.asciidoc[]
|
||||||
include::syntax.asciidoc[]
|
include::syntax.asciidoc[]
|
||||||
|
include::limitations.asciidoc[]
|
||||||
|
|
|
@ -0,0 +1,29 @@
|
||||||
|
[role="xpack"]
|
||||||
|
[testenv="basic"]
|
||||||
|
[[eql-limitations]]
|
||||||
|
== EQL limitations
|
||||||
|
++++
|
||||||
|
<titleabbrev>Limitations</titleabbrev>
|
||||||
|
++++
|
||||||
|
|
||||||
|
experimental::[]
|
||||||
|
|
||||||
|
[discrete]
|
||||||
|
[[eql-unsupported-syntax]]
|
||||||
|
=== Unsupported syntax
|
||||||
|
|
||||||
|
{es} supports a subset of {eql-ref}/index.html[EQL syntax]. {es} cannot run EQL
|
||||||
|
queries that contain:
|
||||||
|
|
||||||
|
* {eql-ref}/functions.html[Functions]
|
||||||
|
|
||||||
|
* {eql-ref}/joins.html[Joins]
|
||||||
|
|
||||||
|
* {eql-ref}/basic-syntax.html#event-relationships[Lineage-related keywords]:
|
||||||
|
** `child of`
|
||||||
|
** `descendant of`
|
||||||
|
** `event of`
|
||||||
|
|
||||||
|
* {eql-ref}/pipes.html[Pipes]
|
||||||
|
|
||||||
|
* {eql-ref}/sequences.html[Sequences]
|
Loading…
Reference in New Issue